Every Windows Server administrator has spent an afternoon clicking through the same installers: Git, 7-Zip, Notepad++, .NET runtimes, Sysinternals tools. Chocolatey \u2014 a package manager for Windows \u2014 turns that into one command per package, or one command for everything. This guide covers installing Chocolatey, the commands you will use daily, and the packages that matter on a server.<\/p>\n\n\n\n
You need PowerShell 5.1 or later and outbound HTTPS access. The official install script is a single PowerShell command (run it in an elevated console):<\/p>\n\n\n\n
Set-ExecutionPolicy Bypass -Scope Process -Force\n[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072\niex ((New-Object System.Net.WebClient).DownloadString('https:\/\/community.chocolatey.org\/install.ps1'))<\/code><\/pre>\n\n\n\nBefore you pipe any remote script into an elevated shell, download it and read it first \u2014 the same advice applies to this one. Chocolatey installs to C:\\ProgramData\\chocolatey<\/code> and adds choco<\/code> to the system PATH; open a new console after installing.<\/p>\n\n\n\nCore Commands<\/h2>\n\n\n\nCommand<\/th> What it does<\/th><\/tr><\/thead> choco search <name><\/code><\/td>Search the community repository<\/td><\/tr> choco info <name><\/code><\/td>Show versions, description, and dependencies<\/td><\/tr> choco install <pkg> -y<\/code><\/td>Install silently (no prompts)<\/td><\/tr> choco upgrade <pkg> -y<\/code><\/td>Upgrade a single package<\/td><\/tr> choco upgrade all -y<\/code><\/td>Upgrade every installed package<\/td><\/tr> choco list<\/code><\/td>List installed packages<\/td><\/tr> choco outdated<\/code><\/td>Show packages with newer versions available<\/td><\/tr> choco uninstall <pkg> -y<\/code><\/td>Remove a package<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nPackages Worth Installing on a Server<\/h2>\n\n\n\n
Install several packages in one go \u2014 Chocolatey resolves and installs them sequentially, and -y<\/code> keeps everything silent:<\/p>\n\n\n\nchoco install git 7zip sysinternals dotnet-8.0-runtime nuget.commandline curl -y --no-progress<\/code><\/pre>\n\n\n\n\ngit<\/code> \u2014 source control and Git Bash on Windows.<\/li>\n7zip<\/code> \u2014 archive handling for logs and backup files.<\/li>\nsysinternals<\/code> \u2014 Process Explorer, Autoruns, and the rest of the troubleshooting kit.<\/li>\ndotnet-8.0-runtime<\/code> or dotnet-sdk<\/code> \u2014 run or build .NET applications without hunting for offline installers.<\/li>\nnuget.commandline<\/code> \u2014 restore packages inside build scripts.<\/li>\nopenssl<\/code> \u2014 inspect certificates and keys from the command line.<\/li>\n<\/ul>\n\n\n\nExport, Import, and Reproduce a Server<\/h2>\n\n\n\n
choco export<\/code> saves your entire package list to a file, and choco install<\/code> accepts that file, so you can recreate a known-good server state on a fresh box:<\/p>\n\n\n\nchoco export C:\\packages.config\n# on the new server:\nchoco install C:\\packages.config -y<\/code><\/pre>\n\n\n\nCombine export with version pinning for reproducible builds: a new server ends up with the same tools, same versions, same flags as the one it replaces. This is the closest Windows gets to a requirements.txt<\/code> for system software.<\/p>\n\n\n\nSources and Private Feeds<\/h2>\n\n\n\n
By default, Chocolatey uses the community repository at community.chocolatey.org. choco source list<\/code> shows your configured sources, and you can add a private feed \u2014 for example an internal NuGet server or a Chocolatey for Business repository \u2014 with:<\/p>\n\n\n\nchoco source add -n=internal -s https:\/\/packages.example.com\/repository\/choco -p<\/code><\/pre>\n\n\n\nKeep the community source enabled unless your organization requires full isolation. Packages from both sources are installed the same way; the source only determines where the package and its scripts are fetched from.<\/p>\n\n\n\n
Keep Everything Updated<\/h2>\n\n\n\n
The command that pays for itself is choco upgrade all -y<\/code>. Pin anything you do not want touched \u2014 for example a runtime your application depends on:<\/p>\n\n\n\nchoco pin add -n=dotnet-8.0-runtime\nchoco upgrade all -y --except=\"'dotnet-8.0-runtime'\"<\/code><\/pre>\n\n\n\nSchedule the upgrade as a weekly task so patching is not a manual chore. A scheduled PowerShell task that runs choco upgrade all -y<\/code> and writes the log to a file is enough for most single-server setups.<\/p>\n\n\n\nRun choco outdated<\/code> before each maintenance window to see exactly what will change, and skim the Chocolatey log afterwards for failed packages \u2014 one pinned package failing should not stop the rest of the upgrade from completing.<\/p>\n\n\n\nSecurity Considerations<\/h2>\n\n\n\n\n- Community packages run install scripts with administrator rights \u2014 check
choco info <pkg><\/code> and read the package’s install script before deploying to production.<\/li>\n- Prefer packages published by verified software vendors where available, and pin versions instead of always taking the latest.<\/li>\n
- Run
choco audit<\/code> to scan installed packages for known vulnerabilities.<\/li>\n- For stricter control, Chocolatey for Business adds private repositories, package approval workflows, and audit reporting.<\/li>\n<\/ul>\n\n\n\n
If your server hosts .NET applications, remember that Chocolatey keeps runtimes updated but does not manage IIS application pools or recycling settings \u2014 those stay your job.<\/p>\n\n\n\n
Troubleshooting Common Failures<\/h2>\n\n\n\n\n- “choco is not recognized”: the PATH change needs a new console; close and reopen it, or re-run the install script.<\/li>\n
- Access denied or exit code 1603 during MSI installs: the shell is not elevated, or a Group Policy blocks Windows Installer \u2014 see our guide to enabling program installation on Windows Server<\/a>.<\/li>\n
- An install hangs: check
C:\\ProgramData\\chocolatey\\logs\\chocolatey.log<\/code> \u2014 it records every step and the exact failing command.<\/li>\n- “Package not found”: verify the exact package ID with
choco search<\/code>; some tools ship under suffixes such as .portable<\/code> or .install<\/code>.<\/li>\n<\/ul>\n\n\n\nChocolatey shines when you provision servers repeatedly. If you are setting up a fresh Windows box, review the configurations in our Windows server feature overview<\/a> and compare Windows server plans on our comparison table<\/a> so the hardware matches the workload you are about to install.<\/p>\n\n\n\n